{
  "family": "olgames",
  "sample_count": 243,
  "category": "infostealer",
  "description": "PWS:Win32/Onlinegames is a highly specialized family of Password Stealers (PWS) engineered specifically to harvest credentials, session tokens, and valuable virtual assets from massively multiplayer online role-playing games (MMORPGs).<br><br><b>Understanding Onlinegames Stealers</b><br>To the victim, this malware results in the devastating loss of high-level gaming accounts and the theft of virtual currency that is often sold for real-world money on black markets. For threat intelligence analysts, Onlinegames stealers represent a highly targeted, lucrative cybercrime niche (particularly prevalent in Asian markets targeting titles like Lineage, World of Warcraft, or local MMORPGs).<br><br><b>Execution and Evasion Strategies</b><br>These stealers are frequently distributed via malicious links within the games themselves, phishing emails masquerading as official game administrators, or bundled with fake 'auto-leveling' bot software. Upon execution, the malware actively hunts for running instances of the target game client. It utilizes sophisticated API hooking, screen scraping, and memory reading techniques to capture the user's password as it is typed into the login prompt. Modern variants also attempt to steal the game's session tokens stored on disk to bypass two-factor authentication (2FA).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the loss of account control and financial theft. Incident responders should analyze the system for unauthorized DLLs injected into the game client's process space (e.g., <code>wow.exe</code>). Threat hunters will often find dropped configuration files or encrypted log files (<code>.dat</code>) in the <code>%AppData%</code> directory containing the stolen keystrokes. Network logs will reveal outbound SMTP or HTTP POST traffic transmitting the stolen credentials back to the attacker's drop zone.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1547.001",
    "T1056.001",
    "T1048",
    "T1055.001",
    "T1555"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Collection"
    },
    {
      "id": "T1555",
      "name": "Credentials from Password Stores",
      "tactic": "Credential Access"
    },
    {
      "id": "T1055.001",
      "name": "Process Injection: Dynamic-link Library Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1048",
      "name": "Exfiltration Over Alternative Protocol",
      "tactic": "Exfiltration"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint to prevent the active exfiltration of captured gaming credentials and session tokens.",
    "Assist the user in immediately recovering their gaming accounts from a known-clean device and forcing a password reset.",
    "Utilize EDR or memory forensics to locate and terminate the keylogging modules injected into the game client or <code>explorer.exe</code>.",
    "Perform a full system sweep to eradicate the dropped executables and delete any temporary log files containing stolen data."
  ],
  "what_to_avoid": [
    "Do not allow the user to type any passwords or access sensitive portals while the machine is infected, as the keylogger captures all input.",
    "Avoid ignoring the infection as 'just a game stealer'; compromised accounts are often heavily linked to the user's primary email and financial accounts."
  ],
  "target_industries": [
    "Financial Services",
    "Retail",
    "Consumers"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}